Fake Police Cryptocurrency Scam: Lessons From a £4 Million UK Fraud Case

Three men have been jailed after impersonating police officers and defrauding eight victims of more than £4 million in cryptocurrency.

According to the Metropolitan Police, the offenders telephoned victims, claimed their cryptocurrency was at risk and persuaded them either to provide account details or transfer funds into what appeared to be secure police-controlled accounts.

The group also created convincing police websites to support the deception. Once transferred, the cryptocurrency was stolen and moved through a complex financial network.

The case demonstrates how authority, urgency and professional-looking digital infrastructure can be combined to persuade victims to authorise substantial cryptocurrency transfers.

It also illustrates why victims should preserve wallet information, transaction records and communications immediately. Blockchain activity may provide investigative leads, but tracing a transaction is not the same as identifying the person controlling a wallet or recovering the funds.

How the fake police cryptocurrency scam operated

The Metropolitan Police said the offenders contacted victims while pretending to be police officers.

Victims were told that their cryptocurrency was at risk. They were then persuaded to disclose account information or transfer their assets to accounts they believed were controlled by the police.

The websites and communications used by the group appeared sufficiently convincing to reinforce the false story.

Once the victims followed the instructions, their cryptocurrency was taken and laundered through a network of transactions.

The fraud relied on several connected techniques:

• Impersonating a trusted authority.
• Creating urgency around the safety of the victim’s assets.
• Using professional-looking websites to support the deception.
• Directing victims to transfer cryptocurrency voluntarily.
• Moving the assets through multiple wallets and financial channels.
• Maintaining contact while the transfer was completed.

The transfer may have been authorised by the victim, but that does not make it legitimate. The authorisation was obtained through deception.

Why police impersonation can be convincing

Fraudsters frequently rely on authority to discourage victims from independently checking what they have been told.

A caller claiming to be a police officer may know the victim’s name, contact details or information about their cryptocurrency holdings. This can make the approach appear credible.

The offender may also provide:

• A supposed officer’s name or identification number.
• A case or crime reference number.
• A telephone number that appears official.
• A link to a cloned police website.
• Documents displaying official logos.
• Instructions not to discuss the supposed investigation.
• Warnings that delay could result in the assets being stolen.

A convincing website does not prove that the caller is genuine. Fraudsters can copy branding, page layouts, contact details and official language from legitimate organisations.

The FCA similarly warns that fraudsters impersonating regulators may use fake communications and websites. The regulator states that it will not ask consumers to transfer money to it or disclose banking passwords and security information.

Warning signs of a fake police cryptocurrency approach

Treat the contact as suspicious where a supposed police officer asks you to:

• Transfer cryptocurrency to a safe or protected wallet.
• Reveal a wallet recovery phrase or private key.
• Provide an exchange password or authentication code.
• Install remote-access software.
• Log in through a link supplied by the caller.
• Keep the investigation secret from your bank, exchange or solicitor.
• Purchase cryptocurrency as part of an investigation.
• Move assets to prove that you are cooperating.
• Act immediately to avoid arrest or financial loss.
• Allow the caller to remain connected while you make the transfer.

Do not verify the caller by using a telephone number, website or email address they supplied.

End the contact and locate the organisation’s details independently. Where someone claims to be a police officer, the relevant police force can advise how to verify their identity through an official channel.

What evidence should victims preserve?

The Metropolitan Police investigation reportedly combined blockchain transactions, communications, financial records, cryptocurrency-exchange records and internet-service-provider data.

Detectives also identified shared aliases, telephone numbers, websites, wallets and spending patterns that connected offences which initially appeared separate.

This highlights the importance of preserving apparently minor identifiers.

Keep:

• The caller’s telephone number.
• Names, ranks and identification numbers provided.
• Emails, texts and messaging-app conversations.
• Website addresses and links.
• Screenshots of fake police websites or portals.
• Cryptocurrency wallet addresses.
• Transaction hashes.
• Exchange deposit and withdrawal records.
• Details of any bank or card payments used to purchase cryptocurrency.
• Remote-access software names and session details.
• Voice notes and call records.
• The exact instructions given by the caller.
• A chronology of each contact and transfer.

Do not annotate or alter the only copy of the evidence.

Export full conversations where possible rather than relying only on isolated screenshots.

What should a victim do after transferring cryptocurrency?

Contact the exchange or wallet provider

Inform the relevant cryptocurrency exchange or custodian immediately.

Provide the transaction hash, destination wallet address, time of transfer and details of the deception.

An exchange may be able to preserve records, flag an account or assess whether funds have reached infrastructure it controls. It cannot necessarily reverse a blockchain transaction or return the assets.

Secure affected accounts

Change passwords for relevant email, exchange and financial accounts.

Also:

1. Enable multi-factor authentication.
2. Review active login sessions.
3. Remove unrecognised devices.
4. Check email-forwarding rules.
5. Change reused passwords.
6. Contact the exchange through its official website.
7. Assess whether remote-access software was installed.
8. Preserve available security and login records.

Never provide a wallet recovery phrase or private key to someone offering to help recover the funds.

Report the fraud

Report the matter through the appropriate police and national fraud-reporting channels.

The Metropolitan Police advises victims and people with information about potential fraud to contact the police and Report Fraud.

People in Scotland should report suspected fraud to Police Scotland. The FCA also directs scam victims to report losses to the UK’s national fraud-reporting service and the relevant regulator where appropriate.

Where there is an immediate threat to personal safety, call 999.

Contact connected banks or card providers

A cryptocurrency loss may also involve conventional payments.

Contact any bank or card provider used to:

• Purchase the cryptocurrency.
• Fund an exchange account.
• Pay fees associated with the transfer.
• Send money directly to the offender.

Provide accurate details and do not describe a payment as unauthorised if you personally initiated it. Explain that you authorised the transfer because of impersonation and deception.

Can stolen cryptocurrency be traced?

Many blockchains maintain public transaction records.

An examination may help identify:

• The movement of assets between wallets.
• The time and value of transactions.
• Connections between addresses.
• Transfers through exchanges or other services.
• Movement across different tokens or blockchains.
• Potential consolidation or cash-out points.

In the £4 million case, police used blockchain records alongside communications, financial information, exchange records and provider data. The successful investigation did not rely on blockchain analysis alone.

A transaction path does not necessarily reveal who controls a wallet.

Private investigators cannot compel an exchange, bank, internet provider or telecommunications company to disclose confidential customer information. Disclosure may require cooperation from the organisation, police powers or an appropriate court order.

Tracing may support legal and investigative decisions, but it does not itself freeze or recover cryptocurrency.

Beware of cryptocurrency recovery scams

Victims may subsequently be approached by people claiming they can recover the cryptocurrency for an advance fee.

The approach may come from:

• A supposed blockchain investigator.
• A fake law firm.
• Someone claiming to work for an exchange.
• A person impersonating the police or FCA.
• An online recovery company promising guaranteed results.
• A social-media account claiming to be an ethical hacker.

Warning signs include demands for cryptocurrency, requests for wallet credentials, guaranteed recovery claims and statements that funds have already been located but cannot be released until a fee or tax is paid.

The FCA warns consumers that it will not contact them to say it is holding recovered money and cannot itself recover losses reported through its scam-reporting process.

Lessons from the £4 million case

The case illustrates five important points.

1. A caller claiming to be from the police should be verified independently.
2. No genuine authority should require a cryptocurrency transfer to a safe wallet.
3. Professional-looking websites and documents can be fabricated.
4. Wallet addresses, transaction hashes and communication records may become important evidence.
5. Tracing assets requires several sources of evidence and does not guarantee recovery.

The group’s victims appear to have been targeted through a carefully organised process rather than a basic unsolicited message.

That makes independent verification particularly important. A person does not need to decide whether the caller sounds genuine. They can end the call and contact the organisation directly through independently obtained details.

How Conflict International may assist

Conflict International supports individuals, businesses and legal advisers dealing with cryptocurrency fraud and impersonation scams.

A proportionate response may include:

• Preserving and organising evidence.
• Reviewing wallet addresses and transaction records.
• Examining online identities, websites and aliases.
• Identifying potential exchange or service touchpoints.
• Preparing an investigation chronology.
• Supporting liaison with solicitors and technical specialists.
• Providing information for police, regulatory or legal review.
• Assessing whether further asset-tracing work is proportionate.

Our Fraud and Financial Investigation Services support clients facing impersonation, payment and cryptocurrency fraud.

Where funds or assets may have been moved through connected entities or jurisdictions, our Asset Tracing Services can help assess available records and potential investigative leads.

No investigator can guarantee that stolen cryptocurrency will be identified, frozen or recovered.

If you have transferred cryptocurrency after contact from someone claiming to be a police officer or public authority, contact Conflict International in confidence to discuss the available evidence, transaction records and proportionate next steps.